API Security 2026: How Not to End Up on Have I Been Pwned?

on YouTube ↗41m

" summary

Practical guidance to secure web APIs in 2026, covering why OAuth 2.1 updates matter and how to avoid common mistakes with JWT, DPoP and mTLS. It also examines Zero Trust and API gateway roles for client trust, and includes a live demo showing how an insecure token can lead to major breaches (e.g., exposed keys on GitHub).

AI-written summary · about

" chapters (12)

1. 0:00API security 2026
2. 4:59OAuth 2.1 and mTLS
3. 6:25JWT token pitfalls
4. 13:29Auth vs authorization
5. 15:15Authorization Code PKCE
6. 17:45OAuth 2.1 changes
7. 21:00Token security best practices
8. 22:24Proof of Possession demo
9. 28:27Zero Trust for APIs
10. 31:37Secure API Gateway demo
11. 37:05API Gateway solutions
12. 39:51Best practices recap

" related talks

• 29mAPI Security in 2017Travis Spencer · Platform Summit 2014
• 53mCommon API Security PitfallsPhilippe De Ryck · NDC Security Oslo 2020
• 35mSecuring Your API: The OWASP Top 10Rob Allen · PHP UK Conference 2026
• 01h 29mAPI Vulnerabilities and What to Do About ThemEoin Woods · ACCU 2021 Online
• 18mAPI Security Simplified: A 5-Pillar ApproachDavid Vazquez Cortizo · apidays London 2023
• 17mAPI Security Simplified: Practical Tips & ToolsTimo Rüppell · apidays London 2023
• 25mAPI Security Deep Dive: Safeguard Your Digital AssetsDan Erez · apidays New York 2023
• 24mSecuring APIs in a Zero Trust Network EnvironmentKazeem Mutiu · apidays London 2025